Release date 2026/08/24
Hardened signature validation against XML Signature Wrapping. The
plugin now checks that the signature Reference URI is a same-document
fragment that names the ID of the element it digests and consumes, so a
signature can no longer be bound to a different element than the one that
provides the identity. A response whose reference URI is empty or not a
same-document fragment is now rejected.
Release date 2026/08/10
Security: Fixed CVE-2026-14917 in the SAML plugin by always validating the samlp:Response signature when idp_certificate is configured correctly, and logging a warning if misconfigured. This prevents a crafted unsigned SAML response from silently bypassing authentication when validate_assertion_signature is set to false.
Release date 2026/08/26
Hardened signature validation against XML Signature Wrapping. The
plugin now checks that the signature Reference URI is a same-document
fragment that names the ID of the element it digests and consumes, so a
signature can no longer be bound to a different element than the one that
provides the identity. A response whose reference URI is empty or not a
same-document fragment is now rejected.
Release date 2026/08/10
Security: Fixed CVE-2026-14917 in the SAML plugin by always validating the samlp:Response signature when idp_certificate is configured correctly (and logging a warning if misconfigured), preventing a crafted unsigned SAML response from silently bypassing authentication under configurations that set validate_assertion_signature to false.
Release date 2026/08/20
Hardened signature validation against XML Signature Wrapping. The
plugin now checks that the signature Reference URI is a same-document
fragment that names the ID of the element it digests and consumes, so a
signature can no longer be bound to a different element than the one that
provides the identity. A response whose reference URI is empty or not a
same-document fragment is now rejected.
Release date 2026/08/10
Security: Fixed CVE-2026-14917 in the SAML plugin by always validating the samlp:Response signature when idp_certificate is configured correctly (and logging a warning if misconfigured), preventing a crafted unsigned SAML response from silently bypassing authentication under configurations that set validate_assertion_signature to false.
Release date 2025/12/18
Fixed an issue that caused a crash when the NameID Format was set to Unspecified.
Release date 2026/08/18
Hardened signature validation against XML Signature Wrapping. The
plugin now checks that the signature Reference URI is a same-document
fragment that names the ID of the element it digests and consumes, so a
signature can no longer be bound to a different element than the one that
provides the identity. A response whose reference URI is empty or not a
same-document fragment is now rejected.
Release date 2026/08/10
Security: Fixed CVE-2026-14917 in the SAML plugin by always validating the samlp:Response signature when idp_certificate is configured correctly, and logging a warning if misconfigured. This prevents a crafted unsigned SAML response from silently bypassing authentication when validate_assertion_signature is set to false.
Release date 2025/11/18
Fixed an issue that caused a crash when the NameID Format was set to Unspecified.
Release date 2026/02/26
Fixed an issue that caused a crash when the NameID Format was set to Unspecified.
Release date 2026/08/31
Hardened signature validation against XML Signature Wrapping. The
plugin now checks that the signature Reference URI is a same-document
fragment that names the ID of the element it digests and consumes, so a
signature can no longer be bound to a different element than the one that
provides the identity. A response whose reference URI is empty or not a
same-document fragment is now rejected.
Release date 2026/08/10
Security: Fixed CVE-2026-14917 in the SAML plugin by always validating the samlp:Response signature when idp_certificate is configured correctly (and logging a warning if misconfigured), preventing a crafted unsigned SAML response from silently bypassing authentication under configurations that set validate_assertion_signature to false.
Release date 2024/09/11
Standardized Redis configuration across plugins. The Redis configuration now follows a common schema shared with other plugins.
Release date 2024/02/12
adjust the priority of the SAML plugin to 1010 to correct the integration between the SAML plugin and other consumer-based plugins
support for consumer group scoping by using pdk kong.client.authenticate function
Release date 2024/05/20
support for consumer group scoping by using pdk kong.client.authenticate function
Release date 2023/12/21
adjust the priority of the SAML plugin to 1010 to correct the integration between the SAML plugin and other consumer-based plugins
Release date 2023/11/08
When the redis session storage is incorrectly configured, users now receive a 500 error instead of being redirected endlessly
Reduce severity of ‘session was not found’ messages to ‘info’
Release date 2026/08/10
Security: Fixed CVE-2026-14917 in the SAML plugin by always validating the samlp:Response signature when idp_certificate is configured correctly (and logging a warning if misconfigured), preventing a crafted unsigned SAML response from silently bypassing authentication under configurations that set validate_assertion_signature to false.
Release date 2024/03/21
support for consumer group scoping by using pdk kong.client.authenticate function
Release date 2023/12/15
adjust the priority of the SAML plugin to 1010 to correct the integration between the SAML plugin and other consumer-based plugins
Release date 2023/09/28
When the redis session storage is incorrectly configured, users now receive a 500 error instead of being redirected endlessly
Release date 2023/10/12
When the redis session storage is incorrectly configured, users now receive a 500 error instead of being redirected endlessly
Release date 2023/10/12
Users will now receive a 500 error instead of being endlessly redirected when the Redis session storage is incorrectly configured.
Release date 2023/03/22
The SAML plugin now works on read-only file systems.
The SAML plugin can now handle the field session_auth_ttl (removed since 3.2.0.0).
Release date 2023/02/28
These plugins now use lua-resty-session v4.0.0.
This update includes new session functionalities such as configuring audiences to manage multiple sessions in a single cookie, global timeout, and persistent cookies.
Due to this update, there are also a number of deprecated and removed parameters in these plugins. See the invidividual plugin documentation for the full list of changed parameters in each plugin.
Improved Plugin Documentation: Revised docs for the following plugins to include examples:
Improved Plugin Documentation: SAML
Fixed an issue where the session_cookie_httponly parameter would always be set to true, even if it was configured as false.
Release date 2022/12/06
Provides SAML v2.0 authentication and authorization between a service provider (Kong Gateway) and an identity provider (IdP).
The anonymous field can now be configured as the username of the consumer. This field allows you to configure a string to use as an “anonymous” consumer if authentication fails.